Polymarket US fell victim to a fraud scheme worth at least $10 million in February 2025, according to a Wall Street Journal investigation. Criminal actors exploited stolen debit cards to infiltrate user accounts on the prediction markets platform during a period of expansion.
Scale and Nature of Attack
Fraudsters linked stolen payment cards to Polymarket accounts, executed bets, and attempted to transfer funds to alternative cards or accounts under their control. During the height of the attack, payment processor Checkout.com flagged more than 80% of deposit attempts as fraudulent, far exceeding the typical industry benchmark of approximately 1%.
Roughly seven user accounts were responsible for the bulk of suspicious activity, with a single account making approximately 4,000 deposit attempts. The majority of fraudulent deposit attempts were unsuccessful, and the exact amount successfully stolen from the attempted $10 million remains unclear.
Internal Response and Leadership Changes
Staff members raised security concerns with CEO Shayne Coplan. According to individuals briefed on internal conversations, Coplan instructed employees to maintain focus on platform expansion and address regulatory issues as they arose.
The company subsequently eliminated a policy requiring users to withdraw funds through the same payment method used for deposits. Multiple staff members cautioned that this change could elevate money-laundering vulnerabilities.
Several senior personnel departed during this period. Andrew Clifford, Polymarket US Chief Compliance Officer, resigned in April following submission of a report detailing fraud-related concerns. The company terminated U.S. CEO Justin Hertzberg's employment, while key regulatory and anti-money-laundering executives also exited.
Security Improvements and Additional Breach
Polymarket deployed enhanced security mechanisms including restrictions on the number of debit cards linkable to individual accounts and partnered with fraud prevention specialist Riskified. Fraud rates had normalized to industry standards by May.
An independent assessment conducted by Sullivan & Cromwell law firm determined that Polymarket maintained regulatory compliance. However, the platform experienced an additional security breach in July affecting nearly 500 users through an account registration vulnerability, allowing attackers to access existing accounts using stolen personal data. Polymarket committed to reimbursing affected users for any losses.
Capital Raise and Future Plans
Polymarket is pursuing approximately $1 billion in new investment at a $21 billion valuation. 1789 Capital is providing about $300 million in the current round, supplementing an earlier investment of approximately $200 million. The company has also recruited former Amazon finance chief Warren Jenson as its inaugural CFO and initiated discussions regarding potential 2027 initial public offering plans.
